CVE-2025-11683

Name	CVE-2025-11683
Description	YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libyaml-syck-perl (PTS)	bullseye	1.34-1	vulnerable
	bookworm	1.34-2	vulnerable
	trixie	1.34-2+deb13u1	fixed
	sid, forky	1.34-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libyaml-syck-perl	source	trixie	1.34-2+deb13u1
libyaml-syck-perl	source	(unstable)	1.34-4

Notes

[bookworm] - libyaml-syck-perl <no-dsa> (Minor issue)
[bullseye] - libyaml-syck-perl <postponed> (Minor issue)
https://github.com/cpan-authors/YAML-Syck/pull/65
https://github.com/cpan-authors/YAML-Syck/commit/dcf4c8477b82ef439f43fd20dc099082d096df02 (v1.36)